ioscompressionvirtual-memorylzo

Does iOS place the LZO magic number at the beginning of compressed memory?

I am trying to decode an iOS memory image. iOS and MacOS now use LZO compression. Is there a magic number placed at the beginning of each compressed page? If so, what is the magic number?

My tests with testmini and minizlo indicates that it does not.

Solution

  • It does not! You need to try to decompress data to see if they are LZO compressed.